Schnorr sign-to-contract and anti-exfil

Makefile.am

@@ -18,6 +18,8 @@ noinst_HEADERS += src/scalar_8x32_impl.h
 noinst_HEADERS += src/scalar_low_impl.h
 noinst_HEADERS += src/group.h
 noinst_HEADERS += src/group_impl.h
+noinst_HEADERS += src/eccommit.h
+noinst_HEADERS += src/eccommit_impl.h
 noinst_HEADERS += src/ecdsa.h
 noinst_HEADERS += src/ecdsa_impl.h
 noinst_HEADERS += src/eckey.h

include/secp256k1_schnorrsig.h

@@ -1,6 +1,8 @@
 #ifndef SECP256K1_SCHNORRSIG_H
 #define SECP256K1_SCHNORRSIG_H
 
+#include <stdint.h>
+
 #include "secp256k1.h"
 #include "secp256k1_extrakeys.h"
 
@@ -13,6 +15,63 @@ extern "C" {
  *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
  */
 
+/** Data structure that holds a sign-to-contract ("s2c") opening information.
+ *  Sign-to-contract allows a signer to commit to some data as part of a signature. It
+ *  can be used as an Out-argument in certain signing functions.
+ *
+ *  This structure is not opaque, but it is strongly discouraged to read or write to
+ *  it directly.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It can
+ *  be safely copied/moved.
+ */
+typedef struct {
+    /* magic is set during initialization */
+    uint64_t magic;
+    /* Public nonce before applying the sign-to-contract commitment */
+    secp256k1_pubkey original_pubnonce;
+    /* Byte indicating if signing algorithm negated the nonce. Alternatively when
+     * verifying we could compute the EC commitment of original_pubnonce and the
+     * data and negate if this would not be a valid nonce. But this would prevent
+     * batch verification of sign-to-contract commitments. */
+    int nonce_is_negated;
+} secp256k1_schnorrsig_s2c_opening;
+
+/** The signer commitment in the anti-exfil protocol is the original public nonce. */
+typedef secp256k1_pubkey secp256k1_schnorrsig_anti_exfil_signer_commitment;
+
+/** Parse a sign-to-contract opening.
+ *
+ *  Returns: 1 if the opening was fully valid.
+ *           0 if the opening could not be parsed or is invalid.
+ *  Args:    ctx: a secp256k1 context object.
+ *  Out: opening: pointer to an opening object. If 1 is returned, it is set to a
+ *                 parsed version of input. If not, its value is undefined.
+ *  In:  input33: pointer to 33-byte array with a serialized opening
+ *
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_s2c_opening_parse(
+    const secp256k1_context* ctx,
+    secp256k1_schnorrsig_s2c_opening* opening,
+    const unsigned char *input33
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a sign-to-contract opening into a byte sequence.
+ *
+ *  Returns: 1 if the opening was successfully serialized.
+ *           0 if the opening was not initializaed.
+ *  Args:     ctx: a secp256k1 context object.
+ *  Out: output33: pointer to a 33-byte array to place the serialized opening
+ *                 in.
+ *  In:   opening: a pointer to an initialized `secp256k1_schnorrsig_s2c_opening`.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_s2c_opening_serialize(
+    const secp256k1_context* ctx,
+    unsigned char *output33,
+    const secp256k1_schnorrsig_s2c_opening* opening
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
 /** A pointer to a function to deterministically generate a nonce.
  *
  *  Same as secp256k1_nonce function with the exception of accepting an
@@ -63,34 +122,65 @@ typedef int (*secp256k1_nonce_function_hardened)(
  */
 SECP256K1_API const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340;
 
+/** First version of the extraparams struct. See `secp256k1_schnorrsig_extraparams` for the
+    latest version and its documentation.
+ */
+typedef struct {
+    unsigned char magic[4];
+    secp256k1_nonce_function_hardened noncefp;
+    void *ndata;
+} secp256k1_schnorrsig_extraparams_v0;
+
 /** Data structure that contains additional arguments for schnorrsig_sign_custom.
  *
  *  A schnorrsig_extraparams structure object can be initialized correctly by
  *  setting it to SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT.
  *
  *  Members:
- *      magic: set to SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC at initialization
- *             and has no other function than making sure the object is
- *             initialized.
- *    noncefp: pointer to a nonce generation function. If NULL,
- *             secp256k1_nonce_function_bip340 is used
- *      ndata: pointer to arbitrary data used by the nonce generation function
- *             (can be NULL). If it is non-NULL and
- *             secp256k1_nonce_function_bip340 is used, then ndata must be a
- *             pointer to 32-byte auxiliary randomness as per BIP-340.
+ *         magic: set to SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC at initialization
+ *                and has no other function than making sure the object is
+ *                initialized.
+ *       noncefp: pointer to a nonce generation function. If NULL,
+ *                secp256k1_nonce_function_bip340 is used
+ *         ndata: pointer to arbitrary data used by the nonce generation function
+ *                (can be NULL). If it is non-NULL and
+ *                secp256k1_nonce_function_bip340 is used, then ndata must be a
+ *                pointer to 32-byte auxiliary randomness as per BIP-340.
+ *   s2c_opening: pointer to an secp256k1_schnorrsig_s2c_opening structure which can be
+ *                NULL but is required to be not NULL if this signature creates
+ *                a sign-to-contract commitment (i.e. the `s2c_data32` argument
+ *                is not NULL).
+ *    s2c_data32: pointer to a 32-byte data to create an optional
+ *                sign-to-contract commitment to if not NULL (can be NULL).
  */
 typedef struct {
     unsigned char magic[4];
     secp256k1_nonce_function_hardened noncefp;
     void *ndata;
-} secp256k1_schnorrsig_extraparams;
+    secp256k1_schnorrsig_s2c_opening* s2c_opening;
+    const unsigned char* s2c_data32;
+} secp256k1_schnorrsig_extraparams_v1;
+
+typedef secp256k1_schnorrsig_extraparams_v1 secp256k1_schnorrsig_extraparams;
+
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC_V0 { 0xda, 0x6f, 0xb3, 0x8c }
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC_V1 { 0x05, 0x96, 0x5b, 0x5c }
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC_V1
+
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT_V0 {\
+    SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC_V0,\
+    NULL,\
+    NULL\
+}
 
-#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC { 0xda, 0x6f, 0xb3, 0x8c }
-#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT {\
-    SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC,\
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT_V1 {\
+    SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC_V1,\
+    NULL,\
+    NULL,\
     NULL,\
     NULL\
 }
+#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT_V1
 
 /** Create a Schnorr signature.
  *
@@ -183,6 +273,82 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(
     const secp256k1_xonly_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
 
+/** Verify a sign-to-contract commitment.
+ *
+ *  Returns: 1: the signature contains a commitment to data32
+ *           0: incorrect opening
+ *  Args:    ctx: a secp256k1 context object, initialized for verification.
+ *  In:    sig64: the signature containing the sign-to-contract commitment (cannot be NULL)
+ *        data32: the 32-byte data that was committed to (cannot be NULL)
+ *       opening: pointer to the opening created during signing (cannot be NULL)
+ */
+SECP256K1_API int secp256k1_schnorrsig_verify_s2c_commit(
+    const secp256k1_context* ctx,
+    const unsigned char *sig64,
+    const unsigned char *data32,
+    const secp256k1_schnorrsig_s2c_opening *opening
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+
+/** Create the initial host commitment to `rho`. Part of the Anti-Exfil Protocol.
+ *
+ *  Returns 1 on success, 0 on failure.
+ *  Args:              ctx: pointer to a context object (cannot be NULL)
+ *  Out: rand_commitment32: pointer to 32-byte array to store the returned commitment (cannot be NULL)
+ *  In:             rand32: the 32-byte randomness to commit to (cannot be NULL). It must come from
+ *                          a cryptographically secure RNG. As per the protocol, this value must not
+ *                          be revealed to the client until after the host has received the client
+ *                          commitment.
+ */
+SECP256K1_API int secp256k1_schnorrsig_anti_exfil_host_commit(
+    const secp256k1_context* ctx,
+    unsigned char* rand_commitment32,
+    const unsigned char* rand32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+ /** Compute signer's original nonce. Part of the Anti-Exfil Protocol.
+ *
+ *  Returns 1 on success, 0 on failure.
+ *  Args:           ctx: pointer to a context object, initialized for signing (cannot be NULL)
+ *  Out:    signer_commitment:  where the signer's public nonce will be placed. (cannot be NULL)
+ *  In:                   msg: the message to be signed (cannot be NULL)
+ *                     msglen: length of the message
+ *                    keypair: pointer to an initialized keypair (cannot be NULL).
+ *          rand_commitment32: the 32-byte randomness commitment from the host (cannot be NULL)
+ */
+SECP256K1_API int secp256k1_schnorrsig_anti_exfil_signer_commit(
+    const secp256k1_context* ctx,
+    secp256k1_schnorrsig_anti_exfil_signer_commitment* signer_commitment,
+    const unsigned char *msg,
+    size_t msglen,
+    const secp256k1_keypair *keypair,
+    const unsigned char* rand_commitment32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);
+
+/** Verify a signature was correctly constructed using the Anti-Exfil Protocol.
+ *
+ *  Returns: 1: the signature is valid and contains a commitment to host_data32
+ *           0: failure
+ *  Args:          ctx: a secp256k1 context object, initialized for verification.
+ *  In:          sig64: pointer to the 64-byte signature to verify.
+ *                 msg: the message being verified. Can only be NULL if msglen is 0.
+ *              msglen: length of the message
+ *              pubkey: pointer to an x-only public key to verify with (cannot be NULL)
+ *         host_data32: the 32-byte data provided by the host (cannot be NULL)
+ *   signer_commitment: signer commitment produced by `secp256k1_schnorrsig_anti_exfil_signer_commit()`.
+ *             opening: the s2c opening provided by the signer (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_anti_exfil_host_verify(
+    const secp256k1_context* ctx,
+    const unsigned char *sig64,
+    const unsigned char *msg,
+    size_t msglen,
+    const secp256k1_xonly_pubkey *pubkey,
+    const unsigned char *host_data32,
+    const secp256k1_schnorrsig_anti_exfil_signer_commitment *signer_commitment,
+    const secp256k1_schnorrsig_s2c_opening *opening
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(8);
+
 #ifdef __cplusplus
 }
 #endif

src/eccommit.h

@@ -0,0 +1,28 @@
+/**********************************************************************
+ * Copyright (c) 2020 The libsecp256k1-zkp Developers                 *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_ECCOMMIT_H
+#define SECP256K1_ECCOMMIT_H
+
+/** Helper function to add a 32-byte value to a scalar */
+static int secp256k1_ec_seckey_tweak_add_helper(secp256k1_scalar *sec, const unsigned char *tweak);
+/** Helper function to add a 32-byte value, times G, to an EC point */
+static int secp256k1_ec_pubkey_tweak_add_helper(const secp256k1_ecmult_context* ecmult_ctx, secp256k1_ge *p, const unsigned char *tweak);
+
+/** Serializes elem as a 33 byte array. This is non-constant time with respect to
+ *  whether pubp is the point at infinity. Thus, you may need to declassify
+ *  pubp->infinity before calling this function. */
+static int secp256k1_ec_commit_pubkey_serialize_const(secp256k1_ge *pubp, unsigned char *buf33);
+/** Compute an ec commitment tweak as hash(pubkey, data). */
+static int secp256k1_ec_commit_tweak(unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
+/** Compute an ec commitment as pubkey + hash(pubkey, data)*G. */
+static int secp256k1_ec_commit(const secp256k1_ecmult_context* ecmult_ctx, secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
+/** Compute a secret key commitment as seckey + hash(pubkey, data). */
+static int secp256k1_ec_commit_seckey(const secp256k1_ecmult_gen_context* ecmult_gen_ctx, secp256k1_scalar* seckey, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
+/** Verify an ec commitment as pubkey + hash(pubkey, data)*G ?= commitment. */
+static int secp256k1_ec_commit_verify(const secp256k1_ecmult_context* ecmult_ctx, const secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
+
+#endif /* SECP256K1_ECCOMMIT_H */

src/eccommit_impl.h

@@ -0,0 +1,73 @@
+/**********************************************************************
+ * Copyright (c) 2020 The libsecp256k1 Developers                     *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#include <stddef.h>
+
+#include "eckey.h"
+#include "hash.h"
+
+/* from secp256k1.c */
+static int secp256k1_ec_seckey_tweak_add_helper(secp256k1_scalar *sec, const unsigned char *tweak);
+static int secp256k1_ec_pubkey_tweak_add_helper(secp256k1_ge *pubp, const unsigned char *tweak);
+
+static int secp256k1_ec_commit_pubkey_serialize_const(secp256k1_ge *pubp, unsigned char *buf33) {
+    if (secp256k1_ge_is_infinity(pubp)) {
+        return 0;
+    }
+    secp256k1_fe_normalize(&pubp->x);
+    secp256k1_fe_normalize(&pubp->y);
+    secp256k1_fe_get_b32(&buf33[1], &pubp->x);
+    buf33[0] = secp256k1_fe_is_odd(&pubp->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
+    return 1;
+}
+
+/* Compute an ec commitment tweak as hash(pubp, data). */
+static int secp256k1_ec_commit_tweak(unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size)
+{
+    unsigned char rbuf[33];
+
+    if (!secp256k1_ec_commit_pubkey_serialize_const(pubp, rbuf)) {
+        return 0;
+    }
+    secp256k1_sha256_write(sha, rbuf, sizeof(rbuf));
+    secp256k1_sha256_write(sha, data, data_size);
+    secp256k1_sha256_finalize(sha, tweak32);
+    return 1;
+}
+
+/* Compute an ec commitment as pubp + hash(pubp, data)*G. */
+static int secp256k1_ec_commit(secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+    unsigned char tweak[32];
+
+    *commitp = *pubp;
+    return secp256k1_ec_commit_tweak(tweak, commitp, sha, data, data_size)
+           && secp256k1_ec_pubkey_tweak_add_helper(commitp, tweak);
+}
+
+/* Compute the seckey of an ec commitment from the original secret key of the pubkey as seckey +
+ * hash(pubp, data). */
+static int secp256k1_ec_commit_seckey(secp256k1_scalar* seckey, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+    unsigned char tweak[32];
+    return secp256k1_ec_commit_tweak(tweak, pubp, sha, data, data_size)
+           && secp256k1_ec_seckey_tweak_add_helper(seckey, tweak);
+}
+
+/* Verify an ec commitment as pubp + hash(pubp, data)*G ?= commitment. */
+static int secp256k1_ec_commit_verify(const secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+    secp256k1_gej pj;
+    secp256k1_ge p;
+
+    if (!secp256k1_ec_commit(&p, pubp, sha, data, data_size)) {
+        return 0;
+    }
+
+    /* Return p == commitp */
+    secp256k1_ge_neg(&p, &p);
+    secp256k1_gej_set_ge(&pj, &p);
+    secp256k1_gej_add_ge_var(&pj, &pj, commitp, NULL);
+    return secp256k1_gej_is_infinity(&pj);
+}
+